The Controller Area Network (CAN) bus communications standard provides a robust communication interface that is used in a wide range of applications including, but not limited to, automobiles and other transportation vehicles, building automation, industrial systems, robotics, and other fields that require communication between embedded digital devices using a shared communication medium. Many CAN bus embodiments employ two electrically conductive wires, which are referred to as CAN-High (CANH) and CAN-Low (CANL), and electronic devices, which are referred to as “nodes” use the CANH and CANL wires as a shared communication medium to transmit and receive data using a standardized data frame format. The CAN bus typically utilizes of a pair of shielded or unshielded twisted pair of cables as the physical medium for signal transmission.
During normal operation, the nodes perform a bus arbitration process when one or more nodes wish to transmit a data frame to ensure that only one node actually transmits data on the CAN-High and CAN-Low lines at a time to provide reliable communication without “collisions” that occur when two or more nodes transmit simultaneously. In the CAN bus standard, when transmitting the dominant bit ‘0’ on the bus, the output pins CANH and CANL are driven to different voltage levels, and the difference from CANH to CANL is the output of the CAN bus. Similarly, transmission of a recessive bit ‘1’ occurs when CANH and CANL are not driven to higher relative voltage levels and will have similar voltage levels. Because the CAN bus is a shared communication medium, every node that is connected to a CAN bus can read each bit of data that is transmitted through the bus. This property of CAN bus presents problems when two nodes wish to communicate data privately that cannot be understood by other nodes that are connected to the bus.
Recent advancements to CAN bus implementations include configurations in which two nodes that are connected to the CAN bus transmit bits of data simultaneously (to produce a collision intentionally) to exchange cryptographic key data in a manner that prevents third party nodes from being able to determine which of the two transmitting nodes is actually transmitting information that forms a part of the cryptographic key. In one part of these key exchange techniques, two nodes simultaneously transmit a logical 1 and a logical 0 signal, followed by simultaneous transmission of the logical complement of the original bits from both nodes, which produces a summed voltage differential between the CANH and CANL wires that can be detected by each of the attached nodes. However, while all of the devices that are attached to the CAN bus can detect the transmission of a dominant bit (logical 0) through the CAN bus, because the two nodes transmit simultaneously the other nodes that are connected to the CAN bus cannot determine which of the two nodes is transmitting the dominant 0 or the non-dominant 1 at any one time during the transmission sequence of the 0/1 bit followed by the logical complement, and only the two transmitting nodes do know which bit is being transmitted. The two nodes transmit the logical 0 and 1 bits and their logical complements in a randomized manner (if both nodes transmit a logical 00/11 sequence or logical 11/00 sequence then the transmission is ignored since those signals do enable third parties to determine the data transmitted from each node), which prevents other nodes connected to the CAN bus from detecting the identity of the node that transmits each bit. This operation, which is repeated many times and combined with other techniques that are not described in greater detail herein, forms the foundation to enable two nodes—and indirectly even larger groups of nodes—to exchange data that form the basis for shared cryptographic keys. After the nodes have exchanged cryptographic keys, those shared keys are used to perform data encryption and authentication/verification operations using techniques that are otherwise known to the art that enable different subsets of the nodes on the bus to exchange data that cannot be decrypted or altered in an undetectable manner by other nodes that are connected to the CAN bus.
As described above, nodes that are connected to the CAN bus with standard CAN bus transceivers can detect the voltage signals corresponding to logical 0 and 1 levels through the CANH and CANL wires of the CAN bus. When two nodes transmit a logical 0 and 1 simultaneously, the transceivers of most standard CAN nodes cannot determine which of the two nodes transmitted the logical 0 and 1. However, at a physical level the electrical signals that are transmitted through the CAN bus do not perfectly correspond to the logical 0 and 1 levels of digital logic that are described above because the physical components of the CAN bus and the nodes themselves have complex and different analog electrical properties. In some instances, an adversary, which is either a legitimate hardware node in the CAN bus that has been compromised by malicious software or an unauthorized hardware device that is electrically connected to the CAN bus, performs high-precision measurements of the properties of the electrical signals that are transmitted through the CAN bus in a manner that may enable the adversary to determine which node transmits the logical 0 and which node transmits the logical 1 signal in the process that is described above. In particular, since both nodes transmit a logical 0 and logical 1 in the randomized order for each bit exchange, the adversary can monitor signal characteristics of the dominant bit signal (the logical 0) that is transmitted from each node. The adversary can then reconstruct the secret data that is shared between the two nodes and compromise the security of the CAN bus system. This class of attacks is referred to as a side-channel attack because the adversary extracts information based on precise electrical signal measurements that are affected by the physical properties of the bus and the nodes that are connected to the bus in a particular CAN bus system even though the adversary has not defeated the logical protocol for cryptographic key exchange that is described above.
FIG. 1 depicts an example of a prior art CAN network 100 that includes three CAN nodes 104, 106, and 108 that are each connected to a CANH conductor 112 and CANL conductor 116 that are terminated by resistors 118 to form a CAN bus. The adversary node 124 is also electrically connected to the CAN bus and the adversary node includes electrical signal measurement and signal processing hardware that enables the adversary to perform one or more side-channel attacks. As described above, side-channel attacks present challenges to maintaining security in shared medium communication networks such as CAN bus. Consequently, improvements to methods and systems that reduce or eliminate the threats from these side-channel attacks would be beneficial.